What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

malware/spyware at startup

15 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
running spybot and adware do not remove problem need expert advise and thank you in advance for looking over my log . This happened once before and always get great help.







Logfile of HijackThis v1.99.1
Scan saved at 2:54:11 PM, on 2/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sympatico.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: SXG Advisor - {EFA7CBC8-4CCD-4ACB-969D-007123ADF44A} - C:\WINDOWS\dntpkwodws.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O3 - Toolbar: ekxdvft - {E5CBFDFA-6B88-4C04-AC4C-C6875D808503} - blank (file missing)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\cdnns.dll' missing
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1178145994406
O17 - HKLM\System\CCS\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: bgrlsmn - {38C9E3DE-6774-4EAA-A32D-62BBB6FB2341} - blank (file missing)
O21 - SSODL: adsoowf - {A987E1B8-9B14-41B0-BE39-3DE24B5ECECA} - C:\WINDOWS\adsoowf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Attachments:

Post #2
Hi! Welcome to the WTT forums.

My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.

Please be patient.



Please make a uninstall list using HijackThis

To access the Uninstall Manager you would do the following:



1. Start HijackThis

2. Click on the Config button

3. Click on the Misc Tools button

4. Click on the Open Uninstall Manager button.

5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.




Download and Run SmitfraudFix

Please download SmitfraudFix (by S!Ri)

Extract the content (a folder named SmitfraudFix) to your Desktop.



Open the SmitfraudFix folder and double-click smitfraudfix.exe

Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).

Please copy/paste the content of that report into your next reply.



Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
Post #3
Thanks For your help Scotty. Here is are the logs you requested. Ad-Aware 2007 Adobe Atmosphere Player for Acrobat and Adobe Reader Adobe Flash Player 9 ActiveX Adobe Reader 7.0.9 Adobe Shockwave Player ATI Catalyst Control Center ATI Display Driver Audiophile USB Broadcom Management Programs Cakewalk Pro Audio 9 Cakewalk VST Adapter [removed] CCleaner (remove only) Civilization III Combo Digital Film Reader USB Conexant HDA D110 MDC V.92 Modem Creative Mass Storage Drivers Creative MediaSource Creative System Information Creative Vienna SoundFont Studio Creative Zen Nano Plus db audioware mastering plugins 1.05c Dell Support 3.1 Delta Force: Xtreme Digital Line Detect Dimension DXi Instrument Dimension Pro 1.2 Enigma High Definition Audio Driver Package - KB835221 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Intel® PROSet/Wireless Software Internet Explorer Default Page J2SE Runtime Environment 5.0 Update 9 JAMMER Professional 6 v6.0.4.1 Kaspersky Online Scanner Learn2 Player (Uninstall Only) Live 6.0.5 Logitech Gaming Software Loop Horse V3.0 M-Audio Series II MIDI McAfee SecurityCenter mCore MCU MD Simple Burner 2.0.03 mDrWiFi mHlpDell Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Flight Simulator 2002 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Plus! Digital Media Edition Installer Microsoft Plus! Photo Story 2 LE Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable mIWA mLogView mMHouse Modem Helper Mozilla Firefox (2.0.0.7) mPfMgr mPfWiz mProSafe MSM32Installer mSSO MSXML 4.0 SP2 (KB925672) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) Musician's Toolbox III Musicmatch for Windows Media Player mWlsSafe mWMI mXML mZConfig NetWaiting NewBlue VideoFX MSP OpenMG Limited Patch 3.4-04-17-06-01 OpenMG Secure Module 3.4.01 Panda ActiveScan PowerDVD 5.7 Project5 Version 2 Project5 Version 2.5 QuickSet QuickTime Rapture 1.1 RealPlayer Registry Mechanic 5.0 rgc:audio sfz VSTi v1.96 rgc:audio Triangle II Rhapsody Player Engine Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Step By Step Interactive Training (KB898458) Security Update for Step By Step Interactive Training (KB923723) Security Update for Windows Internet Explorer 7 (KB928090) Security Update for Windows Internet Explorer 7 (KB929969) Security Update for Windows Internet Explorer 7 (KB931768) Security Update for Windows Internet Explorer 7 (KB933566) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Internet Explorer 7 (KB939653) Security Update for Windows Internet Explorer 7 (KB942615) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944653) Sonic DLA Sonic Foundry ACID 3.0g Sonic Foundry Noise Reduction Plug-In 2.0 Sonic MyDVD LE Sonic RecordNow Audio Sonic RecordNow Copy Sonic RecordNow Data Sonic Update Manager SonicStage 2.0.06 Sony CD Architect 5.2a Sony DVD Architect Studio 4.5 Sony Preset Manager 2.0e Sony Sound Forge 8.0d Sony Vegas Movie Studio Platinum 8.0 Sound Blaster Live! 24-Bit External Spybot - Search & Destroy Spybot - Search & Destroy 1.5.2.20 SSL LMC-1 v1.0 Steinberg Cubase LE Style Enhancer Micro 1.28 Synaptics Pointing Device Driver UltraFast DSL Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB912945) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) WebCyberCoach 3.2 Dell Windows Internet Explorer 7 Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 10 Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 WordPerfect Office 12 SmitFraudFix v2.285 Scan done at 8:12:16.00, Sun 02/10/2008 Run from C:\Documents and Settings\Tony\Desktop\SmitfraudFix\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe C:\Program Files\McAfee\MBK\MBackMonitor.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\PROGRA~1\McAfee.com\Agent\mcagent.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\SiteAdvisor\6253\SAService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\stsystra.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\SiteAdvisor\6253\SiteAdv.exe C:\WINDOWS\System32\M-AudioTaskBarIcon.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Digital Line Detect\DLG.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Internet Explorer\iexplore.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcvsshld.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\adsoowf.dll FOUND ! C:\WINDOWS\dntpkwo???.dll FOUND ! C:\WINDOWS\ffvrdgt.exe FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tony »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Tony\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Tony\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri +————————————————–+ [!] Suspicious: dntpkwodws.dll BHO: SXG Advisor - {EFA7CBC8-4CCD-4ACB-969D-007123ADF44A} TypeLib: {D4A6D6EC-1C0C-4172-ADDD-8C9CFB2D8366} Interface: {32ED82C6-C438-40E0-AB86-C9A7D330837D} Interface: {978BCDD6-2223-4CBA-AD61-B6B79DDF94DC} [!] Suspicious: adsoowf.dll SSODL: adsoowf - {A987E1B8-9B14-41B0-BE39-3DE24B5ECECA} »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="\\\\?\\C:\\WINDOWS\\com9.hdn" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Rustock »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 207.136.100.40 DNS Server Search Order: 209.148.64.40 HKLM\SYSTEM\CCS\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer=207.136.100.40 209.148.64.40 HKLM\SYSTEM\CS1\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer=207.136.100.40 209.148.64.40 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End
Post #4
Hi

Run Smitfraudfix
Open the SmitfraudFix folder again and double-click smitfraudfix.exe
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt



Warning : running option #2 on a non infected computer will remove your Desktop background.


If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

  • Save it to your Desktop.
  • Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
  • Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
  • When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.
Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.



In your next reply post:
rapport.txt
ComboFix.txt
New HijackThis log taken after the above scan has run
Post #5
Here is the 3 logs you asked for Scotty
Thanks
Tony

SmitFraudFix v2.285

Scan done at 19:23:15.78, Mon 02/11/2008
Run from C:\Documents and Settings\Tony\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Error while deleting C:\WINDOWS\dntpkwodws.dll.
C:\WINDOWS\adsoowf.dll deleted.


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

Problem while deleting C:\WINDOWS\dntpkwo???.dll
C:\WINDOWS\ffvrdgt.exe Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 207.136.100.40
DNS Server Search Order: 209.148.64.40

HKLM\SYSTEM\CCS\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer=207.136.100.40 209.148.64.40
HKLM\SYSTEM\CS1\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer=207.136.100.40 209.148.64.40


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Reboot

C:\WINDOWS\dntpkwo???.dll Deleted


»»»»»»»»»»»»»»»»»»»»»»»» End

ComboFix 08-02-12.1 - Tony 2008-02-11 20:12:48.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.386 [GMT -5:00]Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\dat.txt
C:\WINDOWS\search_res.txt

—– BITS: Possible infected sites —–

hxxp://softworldnetwork.com
hxxp://onsafepro.com
.
((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))
.

2008-02-11 19:22 . 2008-02-11 19:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-02-11 19:22 . 2008-02-11 19:22 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-02-11 19:22 . 2008-02-11 19:22 85,504 –a—— C:\WINDOWS\system32\VACFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-02-11 19:22 . 2008-02-11 19:21 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-02-11 19:22 . 2008-02-11 19:22 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-02-10 08:12 . 2008-02-11 19:26 3,364 –a—— C:\WINDOWS\system32\tmp.reg
2008-02-09 14:07 . 2008-02-09 14:07 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-09 14:07 . 2008-02-09 14:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-09 08:09 . 2008-02-09 08:09 d——– C:\Program Files\Lavasoft
2008-02-09 08:09 . 2008-02-09 08:10 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-09 08:08 . 2008-02-09 08:08 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-06 20:47 . 2008-02-06 20:47 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-06 20:47 . 2008-02-06 20:47 3,440 –a—— C:\WINDOWS\unins000.dat
2008-02-02 08:48 . 2008-02-02 08:48 d——– C:\Program Files\Trend Micro
2008-01-27 12:20 . 2008-01-27 12:20 d——– C:\Program Files\M-Audio Audiophile USB

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 03:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 01:53 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-02 13:36 3,140 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-02-01 20:25 ——— d—–w C:\Documents and Settings\Tony\Application Data\SiteAdvisor
2008-01-27 13:30 ——— d—–w C:\Documents and Settings\Tony\Application Data\McAfee
2008-01-19 18:45 ——— d—–w C:\Documents and Settings\Tony\Application Data\Sony
2008-01-05 00:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-05 00:15 ——— d—–w C:\Program Files\M-Audio
2008-01-05 00:14 ——— d—–w C:\Documents and Settings\Tony\Application Data\InstallShield
2008-01-01 18:47 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-01-01 18:47 ——— d—–w C:\Program Files\NetWaiting
2008-01-01 18:47 ——— d—–w C:\Program Files\Modem Helper
2007-12-19 02:35 ——— d—–w C:\Program Files\SiteAdvisor
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-13 02:26 ——— d—–w C:\Program Files\Creative
2007-08-06 00:08 2,197 —-a-w C:\Program Files\unins000.dat
2006-10-06 23:03 1,493,848 —-a-w C:\Program Files\ccsetup133.exe
2003-06-16 19:23 131,072 —-a-w C:\Program Files\T2DXi.dll
2003-06-16 19:17 4,317,184 —-a-w C:\Program Files\Triangle II.dll
2003-06-03 16:33 90,112 —-a-w C:\Program Files\Triangle II.exe
2002-12-17 07:00 82,253 —-a-w C:\Program Files\unins000.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EFA7CBC8-4CCD-4ACB-969D-007123ADF44A}]
C:\WINDOWS\dntpkwodws.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24 20480]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182]
"SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 21:35 397312 C:\WINDOWS\stsystra.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 18:56 761947]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43 45056]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-23 21:19 98304]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920]
"SbUsb AudCtrl"="sbusbdll.dll" [2005-05-26 17:52 128000 C:\WINDOWS\system32\sbusbdll.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00 90112]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 16:16 1121792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-09-07 14:51 49263]
"CTSysVol"="C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-18 21:33 185896]
"McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 04:33 122941]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 16:57 36640]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 21:33 582992]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2007-06-27 09:28 189440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-23 21:18:01 24576]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

R2 MAudioAudiophileService;M-Audio Audiophile Installer;C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe [2007-06-29 09:29]
R2 PPPoEService;PPPoE Service;C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe [2000-07-11 09:48]
R3 MA_CMIDI;M-Audio USB Driver;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2006-08-16 09:23]
R3 MADFU003;MADFU003;C:\WINDOWS\system32\DRIVERS\MADFU003.sys [2007-06-27 09:27]
R3 MAUSBAP;Service for M-Audio Audiophile (WDM);C:\WINDOWS\system32\DRIVERS\mausbap.sys [2007-06-27 09:39]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2005-06-10 09:39]
S3 ENIMSR;ENIMSR;C:\PROGRA~1\Look\ULTRAF~1\app\ENIMSR.SYS [2001-08-06 09:42]
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys []
S3 LMASFltr;LMASFltr;C:\WINDOWS\system32\drivers\LMASFltr.sys [2002-12-04 19:25]
S3 MMAUSB;M Audio USB ASIO Driver;C:\WINDOWS\system32\Drivers\MMAUSB.SYS [2002-12-04 19:25]
S3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2001-08-03 11:32]
S3 NTSTPL1;NTSTPL1;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL1.SYS [2001-08-07 11:08]
S3 NTSTPL2;NTSTPL2;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL2.SYS [2001-08-07 11:08]
S3 NTSTPL3;NTSTPL3;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL3.SYS [2001-08-07 12:08]
S3 NUVision;NUVision II Video Service;C:\WINDOWS\system32\DRIVERS\nuvvid2.sys [2001-10-28 16:34]
S3 RAWESR;RAWESR;C:\PROGRA~1\Look\ULTRAF~1\app\RAWESR.SYS [2001-08-06 09:43]
S3 SAUSBHW;%SAUSBHW.SvcDesc%;C:\WINDOWS\system32\Drivers\sausb.sys [2001-11-07 11:27]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\Look\ULTRAF~1\app\TAPBIND1.SYS [2001-08-07 11:07]
S3 USBNP4X4;M-Audio Audiophile USB Midi;C:\WINDOWS\system32\drivers\usbnp4x4.sys [2007-06-27 09:27]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 23:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (DJHXN1B1-Tony).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-01-01 13:49:44 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2007-01-01 13:49:43 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe.4158 0
"2008-02-12 01:20:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0079AC43-4339-4D9E-9C7C-D56216EEF798}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 20:20:49
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwQueryDirectoryFile, ZwQuerySystemInformation

scanning hidden processes …

scanning hidden autostart entries …

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = \\?\C:\WINDOWS\com9.hdn
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
McAfee Backup = C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe?????????????????????????????????????????????????????????????????????????????????

scanning hidden files …

C:\WINDOWS\com9.hdn 138770 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-02-11 20:23:14
ComboFix-quarantined-files.txt 2008-02-12 01:23:01
.
2008-01-13 11:23:29 — E O F —

Logfile of HijackThis v1.99.1
Scan saved at 8:41:23 PM, on 2/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: SXG Advisor - {EFA7CBC8-4CCD-4ACB-969D-007123ADF44A} - C:\WINDOWS\dntpkwodws.dll (file missing)
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O3 - Toolbar: ekxdvft - {E5CBFDFA-6B88-4C04-AC4C-C6875D808503} - blank (file missing)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1178145994406
O17 - HKLM\System\CCS\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

Thanks
Post #6
Hi

Go to http://virusscan.jotti.org
Copy the following line into the white textbox:
C:\WINDOWS\com9.hdn
Click Submit.
Please post the results of this scan to this thread.


We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

[external image: Posted Image]


Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.
Post #7
Scotty When I typed in C:\WINDOWS\com9.hdn and then clicked submit I got this message. The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file Is that a problem, I'm not sure if I should proceed to the Windows Recovery download if I cannot complete your first request. Thanks
Post #8 last edited
Hi Dont worry about that. Just move on. :thumbup: Also, for a little test, try creating a folder called COM. Let me know what happens.
Post #9
Hi Here is the log from the WindowsRecovery Tool/Comfix. I created the C:\COM folder as you requested and I have not noticed anything happening – the folder is empty. Thanks Tony winxpsp1_en_hom_bf.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Post #10
Hi

Disable Teatimer
First:
  • Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
  • Choose Exit Spybot S&D Resident
Second:
  • Open Spybot S&D
  • Click Mode, check Advanced Mode
  • Go To Left Panel, Click Tools, then also in left panel, click Resident
  • If your firewall raises a question, say OK
  • Uncheck the box labeled Resident Tea-Timer and OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.



Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.


Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C 

KillAll::
 
File::
C:\WINDOWS\dntpkwodws.dll
C:\WINDOWS\com9.hdn
C:\WINDOWS\System32\ntoskrnl.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EFA7CBC8-4CCD-4ACB-969D-007123ADF44A}]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]


Refering to the picture above, drag CFScript into ComboFix.exe


BLACKLIGHT
  • Please download F-Secure Blacklight (fsbl.exe) from here
  • Save into C:\ with a name of fsbl.exe
  • Go to Start > Run
  • Copy and paste the contents of the below codebox into the run box 
    C:\fsbl.exe /expert
  • Click OK
  • This will launch BlackLight
  • Select I accept the agreement
  • Click Next
  • Click Scan
  • Wait for the scan to finish
  • Click on Next>
  • Click Exit
  • A logfile will have been created in the C:\ drive
  • It will be named fsbl-xxxxxxxxxxxxxx.log where xxxxxxxxxxxxxx is the date and time of the scan
  • Use notepad to open that log
  • Post the contents of that log as a reply to this topic together with a new HijackThis log.

In your next reply post:
ComboFix.txt
Blacklight report
New HJT log taken after the above scan has run
Post #13
Sorry for the delay Scotty. here goes… thanks
Tony

ComboFix 08-02-12.1 - Tony 2008-02-18 20:43:19.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.415 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tony\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\com9.hdn
C:\WINDOWS\dntpkwodws.dll
C:\WINDOWS\System32\ntoskrnl.dll
.

((((((((((((((((((((((((( Files Created from 2008-01-19 to 2008-02-19 )))))))))))))))))))))))))))))))
.

2008-02-18 12:32 . 2001-07-21 18:52 33,489 –a—— C:\WINDOWS\system32\CNBJHLP2.HLP
2008-02-18 12:32 . 2001-07-21 18:52 1,075 –a—— C:\WINDOWS\system32\CNBJHLP2.CNT
2008-02-18 12:31 . 2004-08-04 00:56 79,360 –a—— C:\WINDOWS\system32\CNBJMON2.DLL
2008-02-16 18:20 . 2008-02-16 18:20 d——– C:\Program Files\Microsoft Hardware
2008-02-14 21:24 . 2008-02-15 20:15 916,072 –a—— C:\fsbl.exe
2008-02-13 21:33 . 2008-02-13 21:33 d——– C:\COM
2008-02-11 19:22 . 2008-02-11 19:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-02-11 19:22 . 2008-02-11 19:22 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-02-11 19:22 . 2008-02-11 19:22 85,504 –a—— C:\WINDOWS\system32\VACFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-02-11 19:22 . 2008-02-11 19:21 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-02-11 19:22 . 2008-02-11 19:22 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-02-10 08:12 . 2008-02-11 19:26 3,364 –a—— C:\WINDOWS\system32\tmp.reg
2008-02-09 14:07 . 2008-02-17 07:19 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-09 14:07 . 2008-02-09 14:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-09 08:09 . 2008-02-09 08:09 d——– C:\Program Files\Lavasoft
2008-02-09 08:09 . 2008-02-09 08:10 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-09 08:08 . 2008-02-09 08:08 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-06 20:47 . 2008-02-06 20:47 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-06 20:47 . 2008-02-06 20:47 3,440 –a—— C:\WINDOWS\unins000.dat
2008-02-02 08:48 . 2008-02-02 08:48 d——– C:\Program Files\Trend Micro
2008-01-27 12:20 . 2008-01-27 12:20 d——– C:\Program Files\M-Audio Audiophile USB

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 03:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 01:53 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-01 20:25 ——— d—–w C:\Documents and Settings\Tony\Application Data\SiteAdvisor
2008-01-27 13:30 ——— d—–w C:\Documents and Settings\Tony\Application Data\McAfee
2008-01-19 18:45 ——— d—–w C:\Documents and Settings\Tony\Application Data\Sony
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-05 00:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-05 00:15 ——— d—–w C:\Program Files\M-Audio
2008-01-05 00:14 ——— d—–w C:\Documents and Settings\Tony\Application Data\InstallShield
2008-01-01 18:47 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-01-01 18:47 ——— d—–w C:\Program Files\NetWaiting
2008-01-01 18:47 ——— d—–w C:\Program Files\Modem Helper
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-19 02:35 ——— d—–w C:\Program Files\SiteAdvisor
2007-12-18 09:51 179,584 ——w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 02:21 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 02:21 63,488 ——w C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-07 02:21 6,066,176 ——w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-07 02:21 52,224 ——w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-07 02:21 478,208 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 02:21 459,264 ——w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-07 02:21 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-12-07 02:21 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-12-07 02:21 383,488 ——w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-07 02:21 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 02:21 267,776 ——w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-07 02:21 233,472 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-12-07 02:21 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-12-07 02:21 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 02:21 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 02:21 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-12-07 02:21 133,120 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 02:21 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
2007-12-07 02:21 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
2007-12-07 02:21 102,912 ——w C:\WINDOWS\system32\dllcache\occache.dll
2007-12-07 02:21 1,159,680 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-06 11:01 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-08-06 00:08 2,197 —-a-w C:\Program Files\unins000.dat
2006-10-06 23:03 1,493,848 —-a-w C:\Program Files\ccsetup133.exe
2003-06-16 19:23 131,072 —-a-w C:\Program Files\T2DXi.dll
2003-06-16 19:17 4,317,184 —-a-w C:\Program Files\Triangle II.dll
2003-06-03 16:33 90,112 —-a-w C:\Program Files\Triangle II.exe
2002-12-17 07:00 82,253 —-a-w C:\Program Files\unins000.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24 20480]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182]
"SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 21:35 397312 C:\WINDOWS\stsystra.exe]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43 45056]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-23 21:19 98304]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920]
"SbUsb AudCtrl"="sbusbdll.dll" [2005-05-26 17:52 128000 C:\WINDOWS\system32\sbusbdll.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00 90112]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 16:16 1121792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-09-07 14:51 49263]
"CTSysVol"="C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-18 21:33 185896]
"McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 04:33 122941]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 16:57 36640]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 21:33 582992]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2007-06-27 09:28 189440]
"POINTER"="point32.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-23 21:18:01 24576]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

R2 MAudioAudiophileService;M-Audio Audiophile Installer;C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe [2007-06-29 09:29]
R2 PPPoEService;PPPoE Service;C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe [2000-07-11 09:48]
R3 MA_CMIDI;M-Audio USB Driver;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2006-08-16 09:23]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2005-06-10 09:39]
S3 ENIMSR;ENIMSR;C:\PROGRA~1\Look\ULTRAF~1\app\ENIMSR.SYS [2001-08-06 09:42]
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys []
S3 LMASFltr;LMASFltr;C:\WINDOWS\system32\drivers\LMASFltr.sys [2002-12-04 19:25]
S3 MADFU003;MADFU003;C:\WINDOWS\system32\DRIVERS\MADFU003.sys [2007-06-27 09:27]
S3 MAUSBAP;Service for M-Audio Audiophile (WDM);C:\WINDOWS\system32\DRIVERS\mausbap.sys [2007-06-27 09:39]
S3 MMAUSB;M Audio USB ASIO Driver;C:\WINDOWS\system32\Drivers\MMAUSB.SYS [2002-12-04 19:25]
S3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2001-08-03 11:32]
S3 NTSTPL1;NTSTPL1;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL1.SYS [2001-08-07 11:08]
S3 NTSTPL2;NTSTPL2;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL2.SYS [2001-08-07 11:08]
S3 NTSTPL3;NTSTPL3;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL3.SYS [2001-08-07 12:08]
S3 NUVision;NUVision II Video Service;C:\WINDOWS\system32\DRIVERS\nuvvid2.sys [2001-10-28 16:34]
S3 RAWESR;RAWESR;C:\PROGRA~1\Look\ULTRAF~1\app\RAWESR.SYS [2001-08-06 09:43]
S3 SAUSBHW;%SAUSBHW.SvcDesc%;C:\WINDOWS\system32\Drivers\sausb.sys [2001-11-07 11:27]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\Look\ULTRAF~1\app\TAPBIND1.SYS [2001-08-07 11:07]
S3 USBNP4X4;M-Audio Audiophile USB Midi;C:\WINDOWS\system32\drivers\usbnp4x4.sys [2007-06-27 09:27]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 23:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (DJHXN1B1-Tony).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-01-01 13:49:44 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2007-01-01 13:49:43 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe.4158 0
"2008-02-19 02:00:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0079AC43-4339-4D9E-9C7C-D56216EEF798}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 20:54:36
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwQueryDirectoryFile, ZwQuerySystemInformation

scanning hidden processes …

scanning hidden autostart entries …

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs = \\?\C:\WINDOWS\com9.hdn

scanning hidden files …

C:\WINDOWS\com9.hdn 138770 bytes executable

scan completed successfully
hidden files: 1

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
.
**************************************************************************
.
Completion time: 2008-02-18 21:01:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-19 02:01:37
ComboFix2.txt 2008-02-16 01:01:01
ComboFix3.txt 2008-02-12 01:23:17
.
2008-02-16 21:39:58 — E O F —

02/15/08 20:16:37 [Info]: BlackLight Engine 1.0.67 initialized
02/15/08 20:16:37 [Info]: OS: 5.1 build 2600 (Service Pack 2)
02/15/08 20:16:37 [Note]: 7019 4
02/15/08 20:16:37 [Note]: 7005 0
02/15/08 20:16:40 [Note]: 7006 0
02/15/08 20:16:40 [Note]: 7022 0
02/15/08 20:16:40 [Note]: 7011 2896
02/15/08 20:16:40 [Note]: 7026 0
02/15/08 20:16:41 [Note]: 7026 0
02/15/08 20:16:43 [Note]: FSRAW library version 1.7.1024
02/15/08 20:40:28 [Note]: 7007 0
Logfile of HijackThis v1.99.1
Scan saved at 9:01:46 PM, on 2/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O3 - Toolbar: ekxdvft - {E5CBFDFA-6B88-4C04-AC4C-C6875D808503} - blank (file missing)
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [SbUsb AudCtrl] RunDll32 sbusbdll.dll,RCMonitor
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://fulfillment.puretracks.com/onager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1178145994406
O17 - HKLM\System\CCS\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O17 - HKLM\System\CS1\Services\Tcpip\..\{222425A0-A311-465C-B44C-8047840E931C}: NameServer = 207.136.100.40 209.148.64.40
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: M-Audio Audiophile Installer (MAudioAudiophileService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program Files\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: PPPoE Service (PPPoEService) - Unknown owner - C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
Post #15
Scotty, I had to run Gromozon twice because I could not find the log. The first run of Gromozon did REMOVE
the rootkit component. This second log shows that the system is clean. Hope not having that log does not hinder the good work your doing. My system seems to be getting better although I find the buttonbars on some of my software react funny when I pass my mouse pointer in them (they light up a bit and stay that way but software seems to function well despite this problem. Is that a typical of this type of infection?
Thanks
Tony


Removal tool loaded into memory
Gromozon rootkit component not detected - searching for other components
Scanning: C:\WINDOWS
Scanning: C:\Program Files\Common Files


Trojan.Gromozon does not exist - your system is clean.

ComboFix 08-02-12.1 - Tony 2008-02-19 21:15:41.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.523 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-01-20 to 2008-02-20 )))))))))))))))))))))))))))))))
.

2008-02-19 20:02 . 2008-02-19 21:09 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-18 12:32 . 2001-07-21 18:52 33,489 –a—— C:\WINDOWS\system32\CNBJHLP2.HLP
2008-02-18 12:32 . 2001-07-21 18:52 1,075 –a—— C:\WINDOWS\system32\CNBJHLP2.CNT
2008-02-18 12:31 . 2004-08-04 00:56 79,360 –a—— C:\WINDOWS\system32\CNBJMON2.DLL
2008-02-16 18:20 . 2008-02-16 18:20 d——– C:\Program Files\Microsoft Hardware
2008-02-14 21:24 . 2008-02-15 20:15 916,072 –a—— C:\fsbl.exe
2008-02-13 21:33 . 2008-02-13 21:33 d——– C:\COM
2008-02-11 19:22 . 2008-02-11 19:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-02-11 19:22 . 2008-02-11 19:22 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-02-11 19:22 . 2008-02-11 19:22 85,504 –a—— C:\WINDOWS\system32\VACFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-02-11 19:22 . 2008-02-11 19:21 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-02-11 19:22 . 2008-02-11 19:21 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-02-11 19:22 . 2008-02-11 19:22 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-02-10 08:12 . 2008-02-11 19:26 3,364 –a—— C:\WINDOWS\system32\tmp.reg
2008-02-09 08:09 . 2008-02-09 08:09 d——– C:\Program Files\Lavasoft
2008-02-09 08:09 . 2008-02-09 08:10 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-09 08:08 . 2008-02-09 08:08 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-02-06 20:47 . 2008-02-06 20:47 691,545 –a—— C:\WINDOWS\unins000.exe
2008-02-06 20:47 . 2008-02-06 20:47 3,440 –a—— C:\WINDOWS\unins000.dat
2008-02-02 08:48 . 2008-02-02 08:48 d——– C:\Program Files\Trend Micro
2008-01-27 12:20 . 2008-01-27 12:20 d——– C:\Program Files\M-Audio Audiophile USB

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 03:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 01:53 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-02-01 20:25 ——— d—–w C:\Documents and Settings\Tony\Application Data\SiteAdvisor
2008-01-27 13:30 ——— d—–w C:\Documents and Settings\Tony\Application Data\McAfee
2008-01-19 18:45 ——— d—–w C:\Documents and Settings\Tony\Application Data\Sony
2008-01-11 05:53 44,544 —-a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2008-01-05 00:15 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-05 00:15 ——— d—–w C:\Program Files\M-Audio
2008-01-05 00:14 ——— d—–w C:\Documents and Settings\Tony\Application Data\InstallShield
2008-01-01 18:47 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-01-01 18:47 ——— d—–w C:\Program Files\NetWaiting
2008-01-01 18:47 ——— d—–w C:\Program Files\Modem Helper
2007-12-19 23:01 347,136 —-a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ——w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 16:32 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2007-12-08 05:21 3,592,192 —-a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\wininet.dll
2007-12-07 02:21 824,832 —-a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-12-07 02:21 671,232 —-a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-12-07 02:21 63,488 ——w C:\WINDOWS\system32\dllcache\icardie.dll
2007-12-07 02:21 6,066,176 ——w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-12-07 02:21 52,224 ——w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-12-07 02:21 478,208 —-a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-12-07 02:21 459,264 ——w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-12-07 02:21 44,544 ——w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-12-07 02:21 384,512 ——w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-12-07 02:21 383,488 ——w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-12-07 02:21 27,648 —-a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-12-07 02:21 267,776 ——w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-12-07 02:21 233,472 ——w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-12-07 02:21 230,400 ——w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-12-07 02:21 214,528 —-a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-12-07 02:21 193,024 —-a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-12-07 02:21 153,088 ——w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-12-07 02:21 133,120 —-a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-12-07 02:21 124,928 ——w C:\WINDOWS\system32\dllcache\advpack.dll
2007-12-07 02:21 105,984 ——w C:\WINDOWS\system32\dllcache\url.dll
2007-12-07 02:21 102,912 ——w C:\WINDOWS\system32\dllcache\occache.dll
2007-12-07 02:21 1,159,680 —-a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-12-06 11:01 625,664 ——w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-12-06 11:00 70,656 ——w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-12-06 11:00 13,824 ——w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-12-06 04:59 161,792 ——w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\system32\oleaut32.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\system32\dllcache\oleaut32.dll
2007-08-06 00:08 2,197 —-a-w C:\Program Files\unins000.dat
2006-10-06 23:03 1,493,848 —-a-w C:\Program Files\ccsetup133.exe
2003-06-16 19:23 131,072 —-a-w C:\Program Files\T2DXi.dll
2003-06-16 19:17 4,317,184 —-a-w C:\Program Files\Triangle II.dll
2003-06-03 16:33 90,112 —-a-w C:\Program Files\Triangle II.exe
2002-12-17 07:00 82,253 —-a-w C:\Program Files\unins000.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24 20480]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182]
"SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 21:35 397312 C:\WINDOWS\stsystra.exe]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 14:43 45056]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29 49152]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-23 21:19 98304]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30 81920]
"SbUsb AudCtrl"="sbusbdll.dll" [2005-05-26 17:52 128000 C:\WINDOWS\system32\sbusbdll.dll]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 00:00 90112]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 16:16 1121792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-09-07 14:51 49263]
"CTSysVol"="C:\Program Files\Creative\SBLive 24-Bit External\Surround Mixer\CTSysVol.exe" [2003-09-17 10:43 57344]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-11-18 21:33 185896]
"McAfee Backup"="C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe" [2007-01-16 13:59 4838952]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 11:22 20480]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2005-05-31 04:33 122941]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-08-24 16:57 36640]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 21:33 582992]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2007-06-27 09:28 189440]
"POINTER"="point32.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-23 21:18:01 24576]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

R2 MAudioAudiophileService;M-Audio Audiophile Installer;C:\Program Files\M-Audio\Audiophile USB\MAUSBAPInst.exe [2007-06-29 09:29]
R2 PPPoEService;PPPoE Service;C:\PROGRA~1\Look\ULTRAF~1\app\pppoeservice.exe [2000-07-11 09:48]
R3 MA_CMIDI;M-Audio USB Driver;C:\WINDOWS\system32\drivers\ma_cmidi.sys [2006-08-16 09:23]
R3 MADFU003;MADFU003;C:\WINDOWS\system32\DRIVERS\MADFU003.sys [2007-06-27 09:27]
R3 MAUSBAP;Service for M-Audio Audiophile (WDM);C:\WINDOWS\system32\DRIVERS\mausbap.sys [2007-06-27 09:39]
R3 sbusb;Sound Blaster USB Audio Driver;C:\WINDOWS\system32\DRIVERS\sbusb.sys [2005-06-10 09:39]
S3 ENIMSR;ENIMSR;C:\PROGRA~1\Look\ULTRAF~1\app\ENIMSR.SYS [2001-08-06 09:42]
S3 EVOLUSB;%EVOL_USB_SvcDesc%;C:\WINDOWS\system32\drivers\evolusb.sys []
S3 LMASFltr;LMASFltr;C:\WINDOWS\system32\drivers\LMASFltr.sys [2002-12-04 19:25]
S3 MMAUSB;M Audio USB ASIO Driver;C:\WINDOWS\system32\Drivers\MMAUSB.SYS [2002-12-04 19:25]
S3 NTSPPPOE;Efficient Networks Enternet P.P.P.o.E LAN Miniport Driver;C:\WINDOWS\system32\DRIVERS\ntspppoe.sys [2001-08-03 11:32]
S3 NTSTPL1;NTSTPL1;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL1.SYS [2001-08-07 11:08]
S3 NTSTPL2;NTSTPL2;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL2.SYS [2001-08-07 11:08]
S3 NTSTPL3;NTSTPL3;C:\PROGRA~1\Look\ULTRAF~1\app\NTSTPL3.SYS [2001-08-07 12:08]
S3 NUVision;NUVision II Video Service;C:\WINDOWS\system32\DRIVERS\nuvvid2.sys [2001-10-28 16:34]
S3 RAWESR;RAWESR;C:\PROGRA~1\Look\ULTRAF~1\app\RAWESR.SYS [2001-08-06 09:43]
S3 SAUSBHW;%SAUSBHW.SvcDesc%;C:\WINDOWS\system32\Drivers\sausb.sys [2001-11-07 11:27]
S3 TAPBIND;TAPBIND;C:\PROGRA~1\Look\ULTRAF~1\app\TAPBIND1.SYS [2001-08-07 11:07]
S3 USBNP4X4;M-Audio Audiophile USB Midi;C:\WINDOWS\system32\drivers\usbnp4x4.sys [2007-06-27 09:27]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-15 23:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (DJHXN1B1-Tony).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-01-01 13:49:44 C:\WINDOWS\Tasks\McDefragTask.job"
- C:\WINDOWS\system32\defrag.exe
"2007-01-01 13:49:43 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe.4158 0
"2008-02-20 02:15:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{0079AC43-4339-4D9E-9C7C-D56216EEF798}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-19 21:19:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-19 21:19:38
ComboFix-quarantined-files.txt 2008-02-20 02:19:28
ComboFix2.txt 2008-02-19 02:01:57
ComboFix3.txt 2008-02-16 01:01:01
ComboFix4.txt 2008-02-12 01:23:17
.
2008-02-16 21:39:58 — E O F —

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI